Pragmatic Tools for Manual API Testing
As a web application test engineer, you need to test backend (APIs) as easy as frontend (UI in a browser).
--
Dozens of articles appear every year that tell about «the best tools for API testing» including Swagger (which is a tool for documentation and should be implemented by developers), REST Assured (which is a DSL for Java projects and requires programming skills), JMeter (which is a tool for load testing) and other frameworks for automation testing — that is a total mess of approaches and technologies.
I will focus only on tools for functional testing of HTTP/HTTPS REST APIs.
There are several types of tools for testing API by manual testers — from the simplest to the text-based:
- Browsers
- GUI: Postman, Insomnia, Paw, Hoppscotch and TestMace
- CLI: cURL and HTTPie
- VS Code: REST Client and Thunder Client
For all examples I used the latest versions of the apps for macOS Big Sur and OpenWeather API handler: https://api.openweathermap.org/data/2.5/onecall?lat=40.1811&lon=44.5136&appid={api_key}
Browsers
As strange as it may sound, a web browser is the very first tool to start API testing. You can only stop at this tool and test almost everything from DevTools, but it is not too handy.
The browser is best suited for ad hoc checking GET requests. You just need to insert the URI in the address bar. This method is suitable for manual testing of parameters in the query string or testing the correctness of the incoming response — in most cases in JSON format.
Firefox has a built-in JSON viewer with syntax highlighting and a search filter:
«Raw Data» tab shows an unformatted body as it is and «Pretty Print» option converts plain text into a readable form — very convenient for copying:
Chromium-based browsers do not provide JSON viewer out of the box (despite that a primitive viewer in DevTools «Network» tab):
For a nice look of JSON output you had to install extensions: JSON Viewer or JSONVue.
If the API has authorization through cookies (Cookie headers), the browser will automatically path your cookie to a single GET request in the new tab. So, you can test API responses for unauthorized requests by using a Private (Incognito) window.
Even if browsers give enough room for API testing, the use of specialized tools (which will be discussed above) gives more flexibility to work with the API.
GUI
Postman
Today Postman is the most popular tool for API testing. Starting from a browser extension it has become an extremely powerful desktop application for all platforms: Windows, Mac OS and Linux. There is no reason to talk about its features here, because all of them are repeatedly covered in many articles, videos, talks and even courses.
Despite the ongoing promotion of its cloud platform, the app continues to provide for free its main and perfectly working function — issue HTTP requests to an HTTP API.
Insomnia
Insomnia is a worthy alternative to Postman. It is open source, free, has almost the same set of features, more interface themes and supports plugins that extend the standard functionality.
If you are an inexperienced user in API testing or you are overwhelmed with Postman’s features which you do not need — Insomnia is your choice. Advanced Postman’s users may face the absence of some of their usual things, but comparison is not a topic of this article.
Further reading:
- Using Insomnia for API exploration
- API Testing with Insomnia
- How to use Insomnia to Test API Endpoints
- Understanding Insomnia REST Client Made Easy 101
- Postman vs. Insomnia: Comparing the API Testing Tools
Paw
Paw is a powerful API client for Mac users. Since Paw is a native application, it is compact and has macOS graphical user interface, it loads and parses JSON faster than Postman and Insomnia, but it is gorgeously better exactly for 50$.
Further reading:
- Introducing Paw, an HTTP client and API tool for developers
- Paw Tutorial
- Insomnia vs. Postman vs. Paw: Comparing the Top API Clients
Hoppscotch
Hoppscotch (previously known as Postwoman) is a web online API request builder. It means that you do not need to install any desktop application — it is an app inside your browser and can be used on mobile devices. It is open source, free, simple and has a familiar Postman-like interface.
Hoppscotch is a full-fledged web application which requests API directly via browser without any third-party layers. It means you can safely request your company’s internal API inside VPN.
Further reading:
TestMace
TestMace is an IDE for API (as developers call it). It is yet another web app inside Electron’s wrapper as Postman and Insomnia. Unfortunately, I have not found any advantages over competitors (besides, the interface is quite buggy) and I included this tool in the list only because such a thing exists and is under development.
CLI
сURL
сURL is a command-line tool for transferring data through various network protocols including HTTP — exactly what we need for REST API testing. By using cURL you can isolate your requests from the limitations and influences of the frontend environment and generate requests of any complexity that cannot be reproduced in any GUI client.
cURL has a fairly clear syntax for composing requests: -X for request method, -H for headers and -d for body and other options.
My top cURL options:
-i— show response headers in the output;-k— skip certificate verification;-l— follow redirects;-m— set timeout;-v— show the whole HTTP exchange (verbose mode, perfect for serious debugging).
The advantages of cURL is that you can get cURL’s request straight ahead from any browser by «Copy as cURL» in a resource’s menu or by code snippet in Postman.
The next advantage of console utility is that it could be combined with other Unix commands. In the example below I used time to determine the duration of the request and hid output by redirecting stdout to /dev/null:
time curl -s https://api.openweathermap.org/data/2.5/onecall?lat=40.1811&lon=44.5136&appid={api_key} > /dev/null
The only difficulty with cURL is that it does not show JSON from the body in a pretty way. Therefore, you have to use additional tools to parse the response.
Further reading:
- How to test a REST API from command line with curl
- How to use curl to test a REST API
- Testing Endpoints With Curl
By the way, if your API responds with files or you have to test files downloading, then you probably should use Wget instead of cURL.
HTTPie
HTTPie is a fancy command-line HTTP tool. It is promoted as an API testing tool, focused only on HTTP protocol and has built-in JSON support. The request syntax is easy (but differs from cURL) and you do not need to have any special skills to start using it.
The developers are preparing a desktop version of HTTPie which is currently in private beta.
Further reading:
Visual Studio Code
REST Client
Some IDEs have integrated tools for debugging HTTP. For example, Visual Studio Code has a REST Client extension which allows sending HTTP requests and viewing the response directly from the editor. It supports HTTP syntax and cURL commands.
Once you prepared HTTP request, you should evoke command palette (CMD/CTRL + Shift + P) and choose «Rest Client: Send Request» — the response will open on the next tab:
Thunder Client
If you do not want to type the requests, you can compose it directly from Visual Studio Code in a GUI way through Thunder Client. It is very handy to have a Postman-like interface and not to leave your code editor for making HTTP requests.
Thunder Client is a lightweight extension with a limited set of functions, but all of them are exactly what you need for testing. It is also full of neat picky details like full screen mode, opening JSON response in a new tab, and even collections and environments as in a big app.
A «Tests» tab is especially good — it consist of presets of the most useful checks:
Further reading:
I did not mention Soap UI (despite the name it works with REST APIs), which is quite popular in the enterprise sector, but I did not have a chance to use it. Because of this, I can not talk about what I did not touch with my own hands.
